Category: crypto

crypto, data, privacy, web10 Comments

grab the pitchforks!… again

benadida

I’m fascinated with how quickly people have reached for the pitchforks recently when the slightest whiff of a privacy/security violation occurs. Last week, a few interesting security tidbits came to light regarding Dropbox, the increasingly popular cloud-based file storage and synchronization service. There’s some interesting discussion of de-duplication techniques which might lead to Oracle attacks, etc., but the most important issue is that, suddenly, everyone’s realizing that Dropbox could, if needed, access your files. Miguel de Icaza wonders if Dropbox is pitching snake oil. Yes, Dropbox staff can, if needed, access your files. I don’t mean to harp on my … Continue reading grab the pitchforks!… again

crypto, policy, security, web3 Comments

intelligently designing trust

benadida

For the past week, every security expert’s been talking about Comodo-Gate. I find it fascinating: Comodo-Gate goes to the core of how we handle trust and how web architecture evolves. And in the end, this crisis provides a rare opportunity. warning signs Last year, Chris Soghoian and Sid Stamm published a paper, Certified Lies [PDF], which identified the very issue that is at the center of this week’s crisis. Matt Blaze provided, as usual, a fantastic explanation: A decade ago, I observed that commercial certificate authorities protect you from anyone from whom they are unwilling to take money. That turns … Continue reading intelligently designing trust

crypto, voting4 Comments

everything I know about voting I learned from American Idol

benadida

Tonight, American Idol began online voting. Yes, I’m a fan of American Idol, but don’t let that fool you: I’m still a bitchin’ cryptographer. I suspect that American Idol online voting will give rise to many questions such as “wow, awesome, now when can I vote in US Elections with my Facebook account?” and “Why is online voting so hard anyways?” Perhaps I can be of assistance. the voting process So the process is much like other Facebook-connected sites: using Facebook Connect, you log in and grant the American Idol Voting site some permissions, including reading your profile info (ok), … Continue reading everything I know about voting I learned from American Idol

crypto, privacy, web9 Comments

Facebook, the Control Revolution, and the Failure of Applied Modern Cryptography

benadida

In the late 1990s and early 2000s, it was widely assumed by most tech writers and thinkers, myself included, that the Internet was a “Control Revolution” (to use the words of Andrew Shapiro, author of a book with that very title in 1999). The Internet was going to put people in control, to enable buyers to work directly with sellers, to cut out the middle man. Why? Because the Internet makes communication and commerce vastly more efficient, obviating the need for a middle man to connect us. Fast forward to 2011, and the world is vastly more centralized than it … Continue reading Facebook, the Control Revolution, and the Failure of Applied Modern Cryptography

crypto, privacy, security, voting

Crisis in the Java Community… could they have used a secret-ballot election?

benadida

There is a bit of a crisis in the Java community: the Apache Foundation just resigned its seat on the Java Executive Committee, as did two individual members, Doug Lea and Tim Peierls. From what I understand, the central issue appears to be that Oracle, the new Java “owner” since they acquired Sun Microsystems, is paying lip service to the Java Community while taking the language and, more importantly, its licensing, into the direction they prefer, which doesn’t appear to be very open-source friendly. That said, I’m not a Java Community expert, so I won’t comment much more on this … Continue reading Crisis in the Java Community… could they have used a secret-ballot election?

crypto, security, web18 Comments

keep your hands off my session cookies

benadida

For years, security folks — myself included — have warned about the risk of personalized web sites such as Google, Facebook, Twitter, etc. being served over plain HTTP, as opposed to the more secure HTTPS, especially given the proliferation of open wifi networks. But warnings from security freaks rarely get people’s attention. A demonstration is worth a lot more, and that’s exactly what Eric Butler did with FireSheep, a Firefox plugin that lets you instantly see who on your local network is surfing well-known sites, grab their unencrypted cookie, and “become” them on the given site. Nice work Eric! (I … Continue reading keep your hands off my session cookies

crypto, privacy, web2 Comments

Facebook can and should do more to proactively protect users

benadida

A few days ago, the Wall Street Journal revealed that Facebook apps were leaking user information to ad networks. Today, Facebook proposed a scheme to address this issue. This is good news, but I’m concerned that Facebook’s proposal doesn’t address the underlying issue fully. Facebook could be doing a lot more to protect its users, even without giving up on their highly-targeted advertising business model. what, exactly, is going on First, let’s spend one minute describing the problem, because the WSJ’s description was somewhat inaccurate. Harlan Yu at Freedom To Tinker does a good job describing the situation: Facebook loads … Continue reading Facebook can and should do more to proactively protect users